CVE-2026-98432: A Single Packet, No Login: The 9.8 Linux Kernel TCP Bug and How to Protect Your Server

A single packet. No login. CVE-2026-98432 is a Linux kernel bug rated 9.8 (critical) by the kernel CVE team and Ubuntu, and researchers have shown that an AI could write a working exploit for it. Here’s what it is, why it matters, and exactly what to do about it, in plain English.

Watch the video

The bug in slow motion, the stopgaps, and what to do when the fix ships:

What’s the bug?

It lives deep inside Linux, in the part that answers new network connections. A connection comes in, and Linux saves a few details from that first packet (its IP options). Then it throws those details away too soon, while another part of the kernel is still using them. A second packet hits that empty spot, and things fall over.

Best case, the server crashes. Worst case, the attacker runs their own code, using packets alone and no login.

For the technically curious: it’s a use-after-free in the IPv4 TCP connection-setup (SYN-RECV) path. tcp_v4_syn_recv_sock() hands over the IP options from the SYN without copying them, and a retransmitted SYN or SYN-ACK can race and reach that memory after it’s freed. IPv6 is not affected by the main issue. The fix is almost embarrassingly simple: free that memory after everyone is done with it (an RCU grace period). Late, not early.

How bad is it?

• Severity is disputed: the kernel CVE team and Ubuntu say 9.8, Oracle and SUSE say 8.1, and Red Hat says 5.9 because the race is hard to win.
• Researchers described a working exploit written by an AI. The code isn’t public, and the public proof of concept that reached root targeted a Multipath TCP (MPTCP) listener.
• There’s no confirmed exploitation in the wild and it’s not on CISA’s exploited list yet. The capability exists, so don’t wait.

The catch: Ubuntu’s fix isn’t released yet

As of 4 November 2026, Ubuntu’s fixed kernels are in the -proposed testing pocket, not yet released as a security update:

Ubuntu	Fixed kernel (in -proposed)
22.04	5.15.0-203.213
24.04	6.8.0-149.149
26.04	7.0.0-43.43

Red Hat shipped fixed RHEL 8, 9 and 10 kernels on 1 November, and Amazon Linux and AlmaLinux have fixes too. So check your own distribution’s advisory.

Protect yourself today (stopgaps)

These block the known attack paths but don’t fix the bug. Only the kernel update does.

1. Drop IPv4 TCP packets that carry IP options. The bug is triggered by a SYN carrying rare IPv4 header options. Normal web traffic puts its options in the TCP header, not the IP header, so this doesn’t break normal traffic. Red Hat publishes this nftables rule in RHSB-2026-016:

# save as cve-2026-98432.nft
table inet cve_2026_98432 {
  chain input {
    type filter hook input priority -310; policy accept;
    ip protocol tcp ip hdrlength > 5 counter drop
  }
}

sudo nft -f cve-2026-98432.nft
sudo nft list table inet cve_2026_98432

2. Turn off Multipath TCP, which the public root exploit used:

sudo sysctl -w net.mptcp.enabled=0
# make it permanent:
echo 'net.mptcp.enabled = 0' | sudo tee /etc/sysctl.d/99-disable-mptcp.conf

Then restart services that might hold MPTCP sockets (Go 1.24+ apps, for example).

3. Keep the server off the open internet where you can: firewall the ports, use security groups, and allow only trusted sources. Containers share the host kernel, so patch the host or node image, not the container.

When the fix ships: update and reboot

# Ubuntu (once it's released)
sudo apt update && sudo apt full-upgrade && sudo reboot
# RHEL / Rocky / Oracle
sudo dnf update kernel* && sudo reboot
# Amazon Linux 2023
sudo dnf update kernel && sudo reboot

uname -r    # Ubuntu 26.04: 7.0.0-43 or newer

As with Fragnesia, installed isn’t running: the new kernel only runs after a reboot.

Everything shown here was done on a throwaway test virtual machine (QEMU) built for the video, not on a production server. Read and understand each command, try it on a test system first, and back up before changing a real server.

This is a developing CVE. Scores, fixed versions and release status can change, so check your distribution’s advisory before acting. No exploit or proof of concept was shown or sent.

Sources: Ubuntu security tracker · Red Hat RHSB-2026-016 · Aikido · CIQ / Rocky mitigation · SecurityOnline: Ubuntu -proposed

---

More on YouTube

Prefer watching? The full CVE-2026-98432 walkthrough is on our YouTube channel: watch the video. For more hands-on breakdowns of security bugs, Linux servers and dev tools, subscribe at youtube.com/@fineshotai.